The technology transfer package, explained.

Technology transfer in pharma: teaching a second site to make the same medicine

From the choice of a site to a closed transfer report

1. Pick and check the receiving siteDue diligence, a visit, and a written agreement saying who is responsible for what.
2. Build the package and find the gapsGather the reports, compare both sites step by step and write down every difference. This is the subject of this guide.
3. Agree the protocol and sign itScope, acceptance criteria, responsibilities. Both sites and Quality sign.
4. Run rehearsal and qualification batchesEngineering runs if the company chooses them, then process performance qualification (PPQ), which FDA requires before commercial distribution.3
5. Report, file and closeA transfer report states the conclusion, and any change regulators must hear about goes in as a supplement or variation.

Step 2 is the subject of this guide, with enough of steps 3 and 5 to follow the signatures and the changes.

No set contents and optional rehearsals: what surprises newcomers to tech transfer

Four terms to know before you read a transfer protocol

Fourteen terms are defined in the one-page summary.

What goes in a tech transfer package: WHO's document list, aspect by aspect

In shortThe closest thing to a public contents page is Appendix 1 of WHO's 2022 guideline: 52 lines across 11 aspects, offered as examples. It covers far more than the batch record, and starting materials, batch manufacture, packaging and cleaning hold most of the lines.

Ask five companies for their package and you will get five tables of contents. The one public reference point is WHO Technical Report Series No. 1044, Annex 4, whose Appendix 1 lists "documentation commonly required for technology transfer". It warns that "these are examples: all the required documents should be identified for the different tasks".1 We counted its table: 52 lines of documents under 11 headings. The count is ours, since WHO gives none.

WHO's section 12 adds what the sending site should hand over in words: a detailed description of facility requirements and equipment, a description of manufacturing steps as narrative and flowcharts and master batch records, the justification of the control strategy, design space where one exists, validation plans and reports, annual product quality reviews, stability information, and "an authorized set of protocols and work instructions".1 It also asks for history: "any information on the history of process development as well as any historical process changes".1 That last item is the one most often missing, because the history sits in old reports and in the heads of people who have moved on.

The four types of document in every package, and what each one answers

What ICH Q10 says about technology transfer, and what WHO TRS 1044 adds

In shortICH Q10 (Step 4, June 4, 2008) makes transfer a stage of the product's life with one stated goal, and gives you no procedure. WHO's Annex 4 (2022) supplies the procedure: gap analysis first, four phases, a signed protocol, a report.

Most quality staff quote ICH Q10 first. ICH Q10, Pharmaceutical Quality System, reached Step 4 on June 4, 2008, and we found no revision to it. Section 3.1.2 is short enough to give whole:

Three more passages do the practical work. Section 1.6.1 names technology transfer as a source of knowledge to manage, and defines knowledge management as "a systematic approach to acquiring, analysing, storing and disseminating information".4 Section 2.7 says the company "is ultimately responsible" for outsourced work, and that responsibilities belong in "a written agreement between the contract giver and contract acceptor".4 Table III, under change management, says the system "should provide management and documentation of adjustments made to the process during technology transfer activities".4

WHO's Annex 4 reads like the procedure Q10 leaves out. Published in Technical Report Series No. 1044 in 2022, it replaced the 2011 guideline in Series No. 961, Annex 7.1 It starts with due diligence and gap analysis "through visits to the SU and RU", and recommends that "the quality units of the SU and RU participate".1 WHO guidelines are guidance. Regulators in many countries draw on them, while the United States and the European Union write their own binding texts, so a US or EU company uses this one as a checklist of expectations.

The rest of the shelf: which text speaks to which part of a transfer

Tariffs, BIOSECURE and an Annex 15 rewrite: why more products are moving sites in 2026

In shortMost transfer guidance is old and stable. What has changed is the reason to move: a US tariff with lower rates for onshoring plans, a biotech procurement law still to start, and a voluntary FDA pilot for new US sites. In Europe, Annex 15 is being rewritten and the variation codes have changed.

The old texts still stand, so the news is about demand and about rewrites still in draft.

On the demand side, a Section 232 proclamation of April 2, 2026 set a 100% duty on imported patented medicines and their ingredients, with lower rates for some trading partners and 20% for companies with an approved onshoring plan, rising to 100% on April 2, 2030. Generics and biosimilars are left out "at this time".18 The BIOSECURE provisions of Public Law 119-60, section 851 (December 18, 2025) restrict federal procurement, contracts, loans and grants tied to listed biotechnology companies once its limits apply; we found no published list or procurement rule on November 3, 2026, so those limits have not started.19

FDA's PreCheck pilot is a voluntary program for companies building a new US manufacturing facility: it launched February 1, 2026,20 and on June 29, 2026 FDA chose seven participants from more than 80 requests.21

The reasons differ, and the paperwork is the same each time: a company that opens a site or changes a supplier needs a package, a gap analysis, a protocol and, for a marketed product, a filing. McKinsey's survey of more than 300 biopharma leaders, reported in September 2026, says the outsourced share of one common large production format will soon pass half of clinical and commercial supply.22

Tech transfer gap analysis: four kinds of difference between a sending and a receiving site

In shortWHO defines a gap as a critical element the sending unit has and the receiving unit lacks. In practice four kinds appear: a document missing, a document incomplete, two documents that disagree, and a site that cannot do what the document asks. Each kind has its own owner and its own fix.

WHO's definition is the working one: gap analysis is "the identification of the critical elements of a process that are available at the sending unit (SU) but are missing from the receiving unit (RU) with the objective of assessing which gaps have a potential impact on the process or method and to mitigate those gaps, as appropriate".1 Its scope is wide. Section 4.4 names personnel, premises, equipment and instruments, utilities, cleaning, quality control, documentation, computerized systems, qualification, validation, and health, safety and environment, including waste.1 Feasibility adds technical, engineering, business, quality, regulatory, supply and legal aspects (4.5).1

WHO also says what to do with an equipment gap: "the appropriate action should be taken. This may include the adaptation of existing equipment or the acquisition of new equipment", and any adaptation "should be documented" (9.4).1 Its list of factors to review includes "minimum and maximum capacity" and "range of intended use" (9.5), which is why a range in a report has to meet a rating on a list.1

Severity is about what the gap blocks: a batch, qualification, or nothing

A long gap list is useless unless each line says what it stops. Teams usually sort by the next milestone at risk: a gap that blocks the engineering run, a gap that blocks qualification, a gap to close during routine work. No guideline sets those categories, so write yours into the transfer procedure. Every gap then needs a line of evidence, an owner, a due date and a decision. WHO asks that deviations and changes from the plan be "assessed and evaluated before close-out of the project" (12.46), so a gap decided in an email leaves the report with a hole in it.1

The transfer protocol and who approves it: sending site, receiving site, Quality

In shortWHO lists what an authorized transfer document holds, from the team to a parallel comparison of equipment. The sending site vouches for technical accuracy, the receiving site for readiness, and Quality approves. The signature records its meaning.

WHO's section 7.1 gives the fullest public list of what the document should contain: title, objective, scope, names and addresses of both units, the team and its responsibilities, phases and deliverables, approximate timing including trial and validation batches, references to other plans and validation master plans, reference to the gap analysis and risk assessments, acceptance criteria, and "a parallel comparison of premises, equipment, instruments, materials, procedures, and methods".1

Exactly who signs is the company's choice, since no text prescribes the names. The meaning of each signature should be plain, and on an electronic record it has to be. 21 CFR 11.50 requires the printed name, the date and time, and "the meaning (such as review, approval, responsibility, or authorship)".30 EU GMP Annex 11, still at its January 2011 revision, expects electronic signatures to "have the same impact as hand-written signatures within the boundaries of the company", to be permanently linked to their record, and to include time and date.31,32

CDMO tech transfer: the quality agreement and the protocol do different jobs

With a contract manufacturer two documents do different work. The quality agreement says who is responsible for what in general, and comes first. FDA's 2016 guidance covers it, and EU GMP Chapter 7 requires a written contract (7.1).16,15 The transfer protocol says what happens on this product. A package sent before the quality agreement is signed leaves nobody clearly responsible for the gaps it reveals. FDA's biologics guidance adds that "it is incumbent upon the applicant to ensure that contract manufacturing and testing sites have a satisfactory CGMP status for the type of operation involved".33

Reading a readiness score and a risk priority, worked through with numbers

In shortTwo sums appear on most transfers. A checklist score counts how much of the package has evidence, and a risk priority multiplies three judgments. Both are easy to compute and easy to over-read. ICH Q9(R1) warns about the subjectivity in the second.

Teams often track a readiness figure, a share of checklist items with evidence. Take a fictional biologics checklist of 46 items, the size used in this guide's example. No text sets that number, so yours will differ.

Notice two things. The score fell when new knowledge arrived, which is the score working as it should. And an 80% package can still hold a gap that stops a batch, so the score says how far the paperwork has come and leaves out how dangerous the rest is.

For that, teams use a failure mode and effects analysis (FMEA), one of the risk tools ICH Q9(R1) discusses. A common form gives each failure mode three scores, multiplied into a risk priority number: severity, how likely it is to occur, and how hard it is to detect. No regulation sets the scales or the threshold. Here the fictional company acts on anything above 100.

The scores are judgments, and the guideline says so. ICH Q9(R1) says "subjectivity can directly impact the effectiveness of risk management activities and the decisions made", so it should be "managed and minimized".7 Two practical rules follow in a transfer. Re-score detection at the receiving site, because a detection score of 2 that relies on a tool only the sending site owns means nothing at the new site. And have both sites score together. Our fictional case carries both faults on its gap list.

Counting days back from the booked batch

The third sum is the calendar. In the example, October 7 to November 16 is 40 days. An action due October 30 leaves 17 days to read the result and revise the batch record. A study that takes longer than 23 days cannot finish in time, and the question becomes whether the slot moves. That arithmetic is why the date a gap is found matters as much as the gap itself. The numbers here are fictional; the method applies to any booked suite.

How changes are tracked during a transfer: change control, supplements and variations

In shortA transfer is a change on a change: the process is moving, and things keep changing while it moves. ICH Q10 asks for managed, documented adjustments. In the US a site change goes through 21 CFR 314.70 or 601.12, in tiers. In the EU it is a variation, under a newly coded classification.

Our example turned on a change nobody planned, a new revision of a list. Most transfers carry dozens of those. Three kinds of record keep them straight, and they must agree.

Comparability is where the change record meets the science. ICH Q5E covers a biotech manufacturer that changes its process, and its footnote counts facilities and equipment as part of that process. The manufacturer compares product made after the change with product made before it, on the relevant quality attributes. That evaluation "should indicate whether or not confirmatory nonclinical or clinical studies are appropriate".11 The package should therefore hold the comparability plan, with acceptance criteria set before the batches. A plan that defers its criteria until after the batches invites the question of whether the criteria were fitted to the results.

Analytical method transfer: WHO's four routes, and why the test methods can take longest

In shortThe product is only proven at the new site if its tests work there. WHO names four routes. EU GMP asks for a gap analysis and a detailed protocol. A 2025 column says method transfer alone can take up to 18 months, one author's figure for complex biologics.

A process can arrive and still be unusable, because no batch can be released until the receiving laboratory can run the tests. WHO names four ways: "confirmation testing, comparability testing between SU and RU results, co-validation between laboratories, or through paper-based knowledge transfer", and says the chosen strategy "should be risk based and scientifically justifiable" (12.24).1 EU GMP Chapter 6 is firmer: the transferring site verifies the methods match the marketing authorization, reviews their validation, and performs and documents a gap analysis "prior to commencing the technical transfer process" (6.37).14

EU Chapter 6 sets five minimum contents for the method transfer protocol: the testing and methods, the additional training, the standards and samples, any special transport and storage, and "acceptance criteria which should be based upon the current validation study" (6.39).14 Deviations are investigated before closure, and the report documents "the comparative outcome" (6.40).14

The same column says complex products "typically require the transfer of 15 to 20 analytical methods" and advises planning 30% extra material for repeats. It names a slow step that often surprises people: "integrating new technology at a CDMO can take several months to a year".37 It is one practitioner's view of hard products, and a small molecule with compendial tests moves far faster. Plan with your own numbers.

Where tech transfers go wrong, from a lost report to an FDA warning letter

In shortPublished failures are about knowledge lost, comparisons made late, and validation assumed to carry over. FDA rarely uses the word "transfer", so the damage appears under facility and comparability headings. Regulators' data has no transfer category; these numbers are proxies.

To see how often this reaches a regulator, we read openFDA's dataset of 458 published complete response letters, last updated August 13, 2026, with a word search over its text. It is our count, and a word search misses a letter that makes the same point in other words. We read the five letters with transfer wording by hand: each uses it for a site or method transfer, and the letters are for applications in review, so post-approval site moves do not appear.41

Those five letters are worth a look for how plain they are. One asks for "the complete analytical method transfer report". One says "additional testing sites should be supported by appropriate method transfer or method validation data". A 2011 letter reports that a pre-approval inspection found foreign particulate contamination "in all five site transfer batches manufactured at the future commercial site".41 Each is a document or a batch the applicant could have checked first. We do not read this as proof that transfers rarely fail: facility wording covers much else, and most letters say nothing about why a site was in the file.

Inspectors' data gives a second, weaker view. The UK regulator's published GMP deficiency data has no transfer category. It does count deficiencies by EU GMP chapter and annex, and two texts a transfer leans on sit in its top ten for 2019, the newest year published.42 We counted the rows.

Paragraphs 6.37 to 6.41, on method transfer, account for only 9 rows of the 2019 data and 2 of 2018's. Read narrowly, inspectors seldom write that paragraph up. Read fairly, a transfer inspection may be written under a nearby paragraph, and 2019 is seven years old.42

How long a tech transfer takes and what a failed batch costs

In shortThe public figures are few and come mostly from vendors: 6 to 9 months at one contract manufacturer, 12 to 18 months in another's case study. A published model puts one late-stage antibody batch at about $3.12 million. No public figure measures the document work.

The Thermo Fisher Patheon white paper says a transfer of about four months with a complete package is still "pushing it", and calls the 60 days some young companies hope for "virtually impossible".28 The case study says its team "condensed a traditionally 12–18 month tech transfer timeline to just nine months" for one complex biologic, which is the company's account of its own project.44 Moving from six to nine months down to about four saves roughly a third to a half of the time in the first source's terms (our arithmetic). That is the best public argument for doing the document work early, and it still comes from a company that sells transfers.

A batch in dollars, and why the calendar costs more

Farid and colleagues' benchmarking model, published in mAbs in 2020, gives total cost per batch of $0.57 million at preclinical stage, $1.36 million at Phases I and II, and $3.12 million at Phase III and regulatory review.43 It models an antibody batch; put your own figure in any business case. It also explains why a repeat batch hurts: the model includes three consistency batches, and three at that figure come to about $9.4 million, before the plant's calendar. That sum is our arithmetic.

Time usually costs more than the batch, and the calendar cost is harder to publish. A suite slot booked months ahead gets lost, and a contract manufacturer may have no next slot for quarters. On the patient side, FDA's 2019 analysis of shortages found "quality problems are responsible for 62 percent of the drugs that went into shortage between 2013 and 2017".45 That figure is about shortages, with no word about transfers. It is the reason a second site exists, and why a slow one can matter beyond a budget.

Draft Annex 22, FDA's AI draft and ALCOA+: which tech transfer tasks software may take on

In shortReading, citing and comparing documents is a small risk if a person checks each result. Deciding a critical limit is different: draft EU GMP Annex 22 says generative AI "should not be used in critical GMP applications". The draft may widen, and nothing is final as of November 2026.

A transfer package is a document problem, so software is a natural fit: reading reports, pulling each stated limit with its page, comparing two lists, sorting a checklist. Those tasks produce a citation a person can check in a minute. The judgment tasks are different in kind: which of two values transfers, what severity a failure gets, whether a site is ready. Regulators' texts draw lines around that second group.

Data rules apply whichever tool you use. WHO says transfer data "should be in accordance with ALCOA+ principles": attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available (5.18).1 A generated value with no source page fails "attributable" on its face. And any software brings its own burden: an automated system does not reduce what Part 11 asks of signatures or what your procedures ask of reviewers.30

MS&T leads, CDMO templates and software: how transfer packages get built today

In shortA lead in manufacturing science or MS&T builds the package by hand from reports held by several teams, and the receiving site reviews it late. Teams run this in house, through a contract manufacturer's template, or with software. No public source measures the hours.

From process development to CMC regulatory: who holds which part of a package

Where 26 working days go on one package, as one vendor estimates them

We found no independent measure of the document work. One vendor estimates about 26 working days from kick-off to a complete draft for a biologics drug substance transfer, split as below. Treat this as an estimate to replace with yours.

October 7 at Northwind Bio: one equipment list revision, followed to four signatures

In shortOn October 7 the transfer lead picks Plant 3, and every step is compared with its newest equipment list. Step 4 turns red, a risk line is drafted at priority 140, and the gap blocks the November 16 run. A re-check finds two sources that disagree. A person decides each one, and both sites and Quality sign.

1

Ten transfers, ranked by what needs a person

Lena Ortiz, the tech transfer lead, runs a network: plants and contract manufacturers on one list, each with its route, phase, readiness and next milestone. Veltrimab to Plant 3 is in Protocol, with the first engineering run 40 days out.

The list reads 81% and 12 open gaps here, while the workspace reads 80% and 13. The numbers below follow the workspace.

2

Pick a receiving site; every step is compared

The home screen is the process, drawn as 11 connected steps. Picking Plant 3 runs equipment list EQ-P3-0207 rev 2 against every validated range the development reports state, a step at a time, with results shown on the blocks.

Seven steps fit, one needs an adjusted setting, three cannot hold a validated range. Step 4 is marked new, because it was fine under revision 1.

3

The risk line drafts itself, and stays a draft

The Equipment fit analyst shows its reasoning at the step: the rating falls below the range, and making up for it would push the step past another of its limits. It drafts FM-41 for the FMEA: severity 7, occurrence 5, detection 4, risk priority 140, against an action line of 100. FM-28 had scored this step at 56, assuming the validated range.

It proposes an action: a small-scale study at the rating Plant 3 can reach and a review of the next step's capacity, Sam Patel, due October 30. Quality approves the FMEA revision; until then the line is a draft.

4

Into the FMEA, and a gap that blocks the run

One click adds the line and raises G-2611-15. It is High, blocks the engineering run and carries its evidence, three cited passages, an owner and a date. Lena can agree the action, accept the risk or ask Sam Patel. The agents cannot.

5

A re-check, and two sources disagree

Three documents came in since October 2. The gap check reads the three new documents, which brings the package to 46, re-reads its 212 parameters, compares the receiving list again and re-checks the 46 checklist items. It finds one new gap. Readiness falls from 80% to 77%, with 30 found, 8 partial, 5 missing, 1 conflict and 2 not applicable.

The Parameter extractor has found two values for one hold limit. The batch record states one, and the new study supports a longer one and says the batch record was not updated. It records both and picks neither. Lena chooses the batch record value as the operating limit, the study's as the proven limit, with her reason.

6

Every blocking gap has an agreed action; then everyone signs

The protocol's check lists each gap that blocks the run. Five still need a decision, so the Sign button stays locked. Lena reviews each proposed action, with its owner and date, and agrees them. She signs "Approved, transfer lead"; Sam Patel signs for the receiving site, and Omar Haddad approves for Quality. TT-2611 moves to Engineering run, with G-2611-15 still open and its action on record. Dr. Maya Chen's sending-site signature is dated October 5, before the new list was read; check whether your procedure would ask for a fresh one.

The checklist, equipment table, package draft and parameter library behind each transfer

In shortBehind the story sit the transfer workspace, a checklist of 46 items in 10 areas, a side-by-side equipment table, the draft package in the company's template, an activity record, a library of parameters across products, a cross-transfer gap board, a dashboard and the rules a company sets for itself.

The six transfer agents, and the four people who sign over their drafts

In shortSix agents read, extract, compare, check, write gaps and draft. Each has a stated limit. People decide every gap, Quality approves the FMEA and the protocol, and both sites close a gap together. The record supports your compliance with electronic signature rules; Quality still signs.

Each agent's one job on a transfer, and the line it never crosses

Who signs a Veltrimab protocol, and what each signature means

Electronic signatures record the signer, date and time, and the meaning, the fields 21 CFR 11.50 names.30 These are controls that support your compliance with Part 11 and EU Annex 11; your own Quality group decides how the system fits your procedures. Botminds' own credentials are SOC 2 Type II audited and information security managed to ISO 27001. A CDMO user sees only that CDMO's own transfer.

What goes in, what comes out, and the systems it reads

What a gap first found in the suite costs: the batch, the slot and the filing date, on top of the hours

In shortYour people's hours on a package are the part you can see. The expensive part is a gap first found in a batch: the batch, the slot and the filing date that moves. Public numbers are thin, so most of the case rests on your own transfer records.

Six numbers hiding in your last transfer, and where to dig for each

What a missed gap costs that no budget line records

Package hours or repeat batches: which side carries the tech transfer business case

In shortTwo levers can be put in numbers: hours on the package and repeat batches avoided. Most of the value in the second depends on two assumptions you have to supply. Try it with low numbers first.

Hours, batches, calendar and the next site: four levers with their formulas

Calculator: six transfers a year, with your own hours and batch cost

With these defaults, the avoided batches outweigh the hours by about seven to one, and the whole case turns on the 10% and the 50%. Set the first to 0 and you see what the hours alone pay for. If your records show no such repeat batch in three years, believe your records.

Tech transfer readiness check: are your records, equipment lists and gap decisions ready for software?

In shortEight questions, scored 0 to 2, and one for reflection. They test whether your records can be read, whether both sites' lists exist and stay current, and whether a named person decides each gap. Nothing you choose leaves this page.

Questions for tech transfer software vendors: re-rated equipment, conflicting sources and CDMO access

In shortAsk any vendor, us included, to show these on your documents. A strong answer is a demonstration. Look for what happens when a document is revised, and what the tool does when two sources disagree.

Replay a closed transfer first: a twelve-week tech transfer software pilot with planted faults

In shortReplay a closed transfer, so that you already know the answer. Hold back its gap list and its deviations, let the software read the records, and compare. Then run one live transfer in parallel.

Setting up the replay in five steps

1. Pick one closed transfer with a full package and a known list of what went wrong in its runs. A second-source move suits this well.
2. Hold back its gap list, its deviations and the final package. Keep the two equipment lists as they stood at the time.
3. Plant three faults in copies: a revised report, a re-rated line and a hold limit that disagrees with the study. Tell no one on the vendor's side.
4. Have Quality set the rules first: what counts as a find, who decides, what a signature means.
5. Run one live transfer beside your own process, and keep your own process signing.

What to measure at week 12, from planted faults to days to a signed protocol

Tech transfer questions people search: the package, ICH Q10, WHO, sign-off, timelines and AI

In shortThe questions people search, each answered on its own, with the source where a rule is involved.